FranceGDPR Article 9 Special Categories, as Implemented by Loi 78-17 Article 6
Regulation (EU) 2016/679, Art. 9; Loi n. 78-17, Art. 6
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Obtain an explicit General Data Protection Regulation (GDPR) Article 9(2) legal basis before processing biometric, health, or other special-category personal data of a person in France.
- Do not treat a photograph, video, or audio recording as processable merely because it is public; only the narrow Article 9(2)(e) self-disclosure exception applies to an identifier derived from it.
These lines are LexLint's reading of the law's text. Also read by: Commission nationale de l'informatique et des libertés (CNIL) (guidance, recorded ); Case C-184/20 OT v Vyriausioji tarnybinės etikos komisija, judgment of the Court of Justice (Grand Chamber) of (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0184
- Guidance link
- https://www.cnil.fr/fr/le-controle-dacces-biometrique-sur-les-lieux-de-travail
- Case citation
- Case C-184/20 OT v Vyriausioji tarnybinės etikos komisija, judgment of the Court of Justice (Grand Chamber) of
- Guidance body
- Commission nationale de l'informatique et des libertés (CNIL)
- Open questions
- Which condition in Article 9(2) of the GDPR can an employer in France rely on for a biometric system that is not an access-control system within a CNIL standard regulation, given that Article 44 of the Loi names only processing that conforms to a standard regulation?
What it makes you log
Logging duty
Article 9(1) prohibits processing special categories of data, including biometric data used to identify a person, and Article 9(2) lists the exceptions. Neither states a duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
General Data Protection Regulation (GDPR) Article 9(1) lists biometric data processed for unique identification as a special category of personal data. Loi 78-17 Article 6 restates this special-category list with a cross-reference to the Regulation rather than a separate French list. No general publicly-available carve-out narrows this coverage in France; only Article 9(2)(e)'s narrow self-disclosure exception applies.
Article 44 of the Loi lifts the Article 6 prohibition where a condition in GDPR Article 9(2) is met, and for the processing it lists. Those listed processing operations include processing by employers or administrations that conforms to a CNIL standard regulation and concerns biometric data strictly necessary to control access to workplaces and to the devices and applications used for the tasks entrusted to staff.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .